PushSubscription and underlying concept should be better separated

[annevk]

At the moment it seems as if you'd store the private key on an internal slot of the JS object, which isn't safe.

The JS object is also created "in parallel" which doesn't actually work. It needs to be created as part of the steps of the eventual queued task.